AI Discovers Decades-Old Vulnerabilities in PostgreSQL and MariaDB

Security researchers recently disclosed several critical vulnerabilities affecting PostgreSQL and MariaDB after AI-assisted analysis identified memory corruption and validation weaknesses buried deep inside legacy database code. Some of the vulnerable components reportedly existed for more than 20 years before being detected.

The discoveries were made during advanced security testing using AI-powered fuzzing and automated vulnerability analysis techniques. Researchers highlighted how modern AI systems are increasingly capable of identifying complex bugs that traditional security audits may overlook.

One of the most serious vulnerabilities identified in PostgreSQL involves a heap-based buffer overflow inside the widely used pgcrypto extension. The flaw, tracked as CVE-2026-2005, could potentially allow attackers to execute arbitrary code remotely under specific conditions. Researchers stated the vulnerable code had reportedly existed since 2005.

Another PostgreSQL issue, identified as CVE-2026-2006, involved missing validation checks that could also permit arbitrary code execution. Both vulnerabilities received high severity ratings and were patched in recent PostgreSQL security updates.

Researchers also discovered a heap buffer overflow vulnerability in MariaDB’s JSON_SCHEMA_VALID() function. The flaw, tracked as CVE-2026-32710, may allow authenticated attackers to trigger crashes or potentially achieve remote code execution under controlled conditions.

“

AI-assisted auditing is becoming increasingly effective at uncovering deeply hidden vulnerabilities in mature software.

PostgreSQL and MariaDB are among the most widely used open-source database systems globally, powering enterprise applications, cloud infrastructure, SaaS platforms, and web services. Vulnerabilities in core database components can significantly increase the attack surface for organizations operating internet-facing systems.

Researchers noted that many PostgreSQL deployments remain publicly exposed to the internet, increasing concerns about exploitation risks once proof-of-concept details become publicly available.

The incident also highlights the growing influence of AI in cybersecurity research. Modern AI-assisted fuzzing tools can analyze massive codebases, identify unusual execution paths, and uncover hidden memory corruption bugs far faster than traditional manual review methods.

Security experts believe AI-driven vulnerability discovery could accelerate both defensive security research and offensive exploitation capabilities in the coming years.

Database administrators are encouraged to deploy the latest security updates as soon as possible and review environments for exposed services that could increase exploitation risk.